Github 投毒 1x (提取PS脚本VT处扫3)

Fadouse

Github 项目链接：https://github.com/orgs/DusthenTe/repositories

该项目下均为投毒vs项目，编译前执行图片中混淆指令
相关行为:

https://s.threatbook.com/report/file/d60a8d95751656d85f061c2e2a5ab6200c90a932d1f184d8a7af4ab313f6c280
https://app.any.run/tasks/86278530-efde-430a-9d88-12a2c1b1f2a5



提取物ps1 报毒如下


提取物ps1下载:
https://wormhole.app/Yr6jp#BDYC4ptJgY-VI-FSc5nnGg

wywt123

一顿base64
动态获取payload地址的几个url

1. hxxps://rlim.com/seraswodinsx/raw
   
2. hxxps://paste.fo/raw/rb5182fbdbf2
   
3. hxxps://pastebin.com/raw/LC0H4rhJ
   
4. hxxps://pastejustit.com/raw/tfauzcl5xj

复制代码

下载payload

1. hxxps://github.com/Fxkw45/delhi-metro/releases/download/metro/SearchFilter.7z

复制代码

解压密码

1. hR3^&b2%A9!gK*6LqP7t$NpW

复制代码

pal家族

事件: 对象已删除
用户: 小之之的微星\72428
用户类型: 活动用户
组件: 病毒扫描
结果: 已删除
结果描述: 已删除
类型: 木马
名称: Trojan.Script.Agent.ss
精确度: 确切
威胁级别: 高
对象类型: 文件
对象名称: main.js
对象路径: E:\virus\SearchFilter\resources\app.asar//
对象的 MD5: 034F0273DEB7085265111D418AE35B75


事件: 检测到恶意对象
应用程序: Windows PowerShell
用户: 小之之的微星\72428
用户类型: 发起者
组件: 系统监控
结果描述: 检测到
类型: 木马
名称: PDM:Trojan.Win32.Bazon.a
威胁级别: 高
对象类型: 进程
对象路径: D:\360极速浏览器X下载
对象名称: downloader.ps1
原因: 行为分析
数据库发布日期: 昨天，2025/1/8 21:44:00
MD5: 5D2728C0D189BB1F818519D56BC54732

心醉咖啡

火绒

莒县小哥

1073328164

迈克菲扫描 miss

lsop1349987

avast运行miss

yaokai815

腾管 360 瑞星均1x

wywt123

昨天report abuse了，今天github给ban掉了

Hi   ,

Our review of the account(s) and/or content named in your report has concluded. We have determined that one or more violations of GitHub’s Terms of Service have occurred and have taken appropriate action in response.

Please note that our response to abuse on GitHub varies depending on the exact circumstances of each case, as noted in our Community Guidelines:

What happens if someone violates GitHub's Policies

Additional information on dealing with offensive users or content can be found here:

What if something or someone offends you?

Thank you for helping create a safe and welcoming environment for software developers.

Regards,
GitHub Trust & Safety